cvs commit: ports/audio/arts Makefile

[Jacques A. Vidrine]

On Tue, Mar 02, 2004 at 10:38:31AM -0500, Will Andrews wrote:
> On Tue, Mar 02, 2004 at 07:47:52AM -0600, Jacques A. Vidrine wrote:
> > P.S.  I don't mean to pick on this port in particular.  I believe there
> > are other ports that install set-user-ID binaries where it is not
> > essential.  I just haven't had a chance to make a sweep of the tree yet
> > to identify them.
> 
> I agree with Michael - I'd rather have working software than
> a false sense of security, when it comes to desktop software.
> 
> If you are going to push a "make all setuid bits optional"
> agenda, 

I have no intention.  However, for ports that do not require the
set-user-ID bit in order to function  (and this is demonstrably true
with arts), I would like not to install with set-user-ID by default.

> I suggest coming up with a standard means of letting the
> administrator specify their policy regarding those.  You could
> also offer alternate means of achieving the effect that set-id
> wrappers/programs intend with their privileges.
> 
> Unfortunately, in arts' case, setpriority(2) is superuser-only.
> Perhaps in FreeBSD 5, we should start implementing standard means
> of allowing programs like artsd to call setpriority(2) without
> privileges, e.g. through MAC.

Yes, we should follow up on these thoughts.

Cheers,
-- 
Jacques Vidrine / nectar at celabo.org / jvidrine at verio.net / nectar at freebsd.org